ALAS2023-2026-3356

References: CVE-2026-114583  CVE-2026-115557 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.

This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter. (CVE-2026-114583)

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

Issue Correction:
Run dnf update python3.11 --releasever 2023.12.20261102 or dnf update --advisory ALAS2023-2026-3356 --releasever 2023.12.20261102 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3.11-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-debugsource-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-devel-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-idle-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-tkinter-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-debug-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-debuginfo-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-libs-3.11.18-1.amzn2023.0.1.aarch64
    python3.11-test-3.11.18-1.amzn2023.0.1.aarch64

src:
    python3.11-3.11.18-1.amzn2023.0.1.src

x86_64:
    python3.11-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-devel-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-idle-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-tkinter-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-debugsource-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-debug-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-debuginfo-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-libs-3.11.18-1.amzn2023.0.1.x86_64
    python3.11-test-3.11.18-1.amzn2023.0.1.x86_64